Transaction Authentication Using Network

• US 20080040276A1
• Filed: 06/18/2007
• Published: 02/14/2008
• Est. Priority Date: 06/19/2006
• Status: Abandoned Application

• Current Assignee: Visa USA, Inc. (Visa, Inc.)
• Original Assignee: Visa USA, Inc. (Visa, Inc.)
• Inventors: Faith, Patrick, Hammad, Ayman, Carlson, Mark
• Application Number:
  US11/764,343
• Publication Number:
  US 20080040276A1
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06Q 20/085 involving remote charge determination or related payment systems
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Systems and method for improved consumer and portable consumer device authentication are disclosed. Such systems and methods may include using dynamic verification values, challenge questions, and consumer notification as ways to prevent fraudulent transactions from being conducted.

Claims

1. A method comprising:

performing an authentication process for a consumer, wherein the consumer uses a portable consumer device to conduct a transaction;

performing an authentication process for the portable consumer device, wherein performing the authentication process for the portable consumer device comprises verifying a fingerprint or a dynamic verification value associated with the portable consumer device; and

performing a risk analysis after authenticating the consumer and authenticating the portable consumer device are performed, wherein the risk analysis determines whether or not the transaction is to be authorized.

2. The method of claim 1 further comprising notifying the consumer that the transaction is occurring.

3. The method of claim 1 wherein the fingerprint is a magnetic stripe fingerprint.

4. The method of claim 1 wherein the portable consumer device is a phone.

5. The method of claim 1 wherein the authentication process for the consumer comprises sending a challenge message to the consumer.

6. A system comprising:

means for performing an authentication process for a consumer, wherein the consumer uses a portable consumer device to conduct a transaction;

means for performing an authentication process for the portable consumer device, wherein performing the authentication process for the portable consumer device comprises verifying a fingerprint or a dynamic verification value associated with the portable consumer device; and

means for performing a risk analysis after authenticating the consumer and authenticating the portable consumer device is performed, wherein the risk analysis determines whether or not the transaction is to be authorized.

7. A computer readable medium comprising:

code for performing an authentication process for a consumer, wherein the consumer uses a portable consumer device to conduct a transaction;

code for performing an authentication process for the portable consumer device, wherein performing the authentication process for the portable consumer device comprises verifying a fingerprint or a dynamic verification value associated with the portable consumer device; and

code for performing a risk analysis after authenticating the consumer and authenticating the portable consumer device are performed, wherein the risk analysis determines whether or not the transaction is to be authorized.

8. The computer readable medium of claim 7 wherein the portable consumer device is a phone.

9. A server comprising the computer readable medium of claim 8.

10. A system comprising the server of claim 9.

11. A method comprising:

authenticating a portable consumer device using dynamic data generated by the portable consumer device or an access device in communication with the portable consumer device; and

authenticating the consumer comprising sending a challenge message to the consumer, and receiving a challenge response from the consumer.

12. The method of claim 11 wherein the challenge message is a challenge question.

13. The method of claim 11 wherein the portable consumer device is a card.

14. The method of claim 11 wherein challenge message is sent by a non-merchant entity.

15. A computer readable medium comprising:

code for authenticating a portable consumer device using dynamic data generated by the portable consumer device or an access device in communication with the portable consumer device; and

code for authenticating the consumer comprising sending a challenge message to the consumer, and receiving a challenge response from the consumer.

16. A server computer comprising the computer readable medium of claim 15.

17. A payment processing system comprising the server computer of claim 16.

18. A method comprising:

receiving an authorization request message associated with a transaction conducted using a portable consumer device, wherein the portable consumer device comprises a portable consumer device fingerprint, and wherein the authorization request message comprises an altered portable consumer device fingerprint and an algorithm identifier;

selecting an algorithm from among a plurality of algorithms using the algorithm identifier;

determining the portable consumer device fingerprint using the selected algorithm and the altered portable consumer device fingerprint;

determining if the portable consumer device fingerprint matches a stored portable consumer device fingerprint;

sending a challenge message to a consumer associated with the portable consumer device; and

sending an authorization response message to the consumer, wherein the authorization response message indicates whether or not the transaction is approved.

19. The authentication method of claim 18 further comprising receiving dynamic data, and evaluating the dynamic data to authenticate the portable consumer device.

20. The method of claim 18 wherein the challenge message is a challenge question.

21. A computer readable medium comprising:

code for receiving an authorization request message associated with a transaction conducted using a portable consumer device, wherein the portable consumer device comprises a portable consumer device fingerprint, and wherein the authorization request message comprises an altered portable consumer device fingerprint and an algorithm identifier;

code for selecting an algorithm from among a plurality of algorithms using the algorithm identifier;

code for determining the portable consumer device fingerprint using selected algorithm and the altered portable consumer device fingerprint;

code for determining if the portable consumer device fingerprint matches a stored portable consumer device fingerprint;

code for sending a challenge message to a consumer associated with the portable consumer device; and

sending an authorization response message to the consumer, wherein the authorization response message indicates whether or not the transaction is approved.

22. A server computer comprising the computer readable medium of claim 21.

23. A method comprising:

authenticating a batteryless portable consumer device, wherein the portable consumer device comprises a batteryless portable consumer comprising an antenna;

authenticating the consumer; and

sending a notification message to the consumer that a transaction is being conducted.

24. The method of claim 23 wherein authenticating the consumer comprises sending a challenge to the consumer.

25. The method of claim 23 wherein sending the notification message comprises sending the notification message to the consumer'"'"'s phone.

26. The method of claim 23 wherein the batteryless portable consumer device is capable of generating a verification value.

27. A computer readable medium comprising:

code for authenticating a batteryless portable consumer device, wherein the portable consumer device comprises a batteryless portable consumer comprising an antenna;

code for authenticating the consumer; and

code for sending a notification message to the consumer that a transaction is being conducted.

28. A server computer comprising the computer readable medium of claim 27.

29. A system comprising the server computer;

and an access device coupled to the server computer.